5 ms·

Even highly regulated fields like medicine or aerospace have frequent instances of irresponsibility for profit. Only fines that wipe out the profits of operatin

Even highly regulated fields like medicine or aerospace have frequent instances of irresponsibility for profit. Only fines that wipe out the profits of operating irresponsibly will get through them. Conversely, we don't want to lose FOSS because single developers can't cope with the legal risks. Maybe there's opportunity for incentivizing cheap security certification of FOSS, or a CISA-approved subset of FOSS that is guaranteed to follow strict security practices.

V__ 3y ago
I dont't think this would be a problem for FOSS. If I release an unsafe or not code compliant kitchen/house/etc. blueprint (and don't make claims to the contrary) nothing would happen to me. If I sell them the situation might be different. I think the same would apply to FOSS.
- insanitybit 3y ago
  Unless code somehow stops being speech, I see no way that this could impact FOSS (in the US).
- ThrowawayR2 3y ago
  All that that strategy would mean is that the costs of security auditing would fall onto the business using the FOSS code. It will start looking very attractive to instead buy code from an established software vendor who will provide some level of liability guarantees and assistance in auditing rather than going it alone with FOSS and in-house or external auditing.
  - hiatus 3y ago
    The costs of security auditing already fall onto the businesses using FOSS code, though. A business just blindly incorporating code without static analysis, vulnerability checks, etc is not exercising due care.
  - TeMPOraL 3y ago
    So basically, it would work like in every other industry? FOSS, for all the good it does, it also did break the economics of software. How much of the current problems with adtech, surveillance capitalism and VC funding stems from FOSS making it impossible to simply sell software components like products?
    - wbl 3y ago
      None of it. Emacs didn't kill word or Wang or WordPerfect. OS vendors still make money despite Linux and FreeBSD. The GIMP didn't kill Adobe. And if you want to sell proprietary libraries your market is going to be limited because OSs will distribute them and it will be hard to keep up when customers are fixing their own problems. What killed the shrink-wrapped market was first piracy and secondly the way people use their computers change. Then add on the easy sharing that e.g. Google docs enables and it's all over but the shouting. The SAAS model also has the benefit of aligning value delivery with outlays temporally. No more wait a year before shipping: instead get quick iteration with an ongoing revenue stream. You can recover from missteps in a way that the old model could not.
      - TeMPOraL 3y ago
        > Emacs didn't kill word or Wang or WordPerfect. Not sure how to respond to that. Emacs is around, the latter two I believe not, but approximately nobody is using them anyway. And I say that as someone who lives in Emacs. > OS vendors still make money despite Linux and FreeBSD. Apple makes money on hardware. Microsoft makes money on cloud, and has been desperately trying to turn Windows into a subscription service for a while now. They even non-humorously said exactly this in some message in (IIRC) installer or update screen - I remember Windows 10 telling me "Windows is a service" as if that was a good thing. > The GIMP didn't kill Adobe. No, but again, GIMP and Krita are used by approximately no one, meanwhile Adobe switched to a quite abusive subscription model. > And if you want to sell proprietary libraries your market is going to be limited because OSs will distribute them and it will be hard to keep up when customers are fixing their own problems. I don't see how. Think about the 100 (or 10 000, if you're doing webdev) dependencies your product uses. Most of those could be a licensed product, creating a cottage industry of small vendors making a living from developing specialized libraries. This thing is real in some areas, e.g. industrial software, where there are e.g. protocols that are too complex and boring for Open Source community to care about supporting in full. But it's something impossible in general, because popularity of open source simply prevents this kind of market from forming. Now, to be clear: I don't have a strong opinion on whether this is good or bad. Still trying to fully understand that one. But what I know for sure is that open source is a huge disruption to how the market would've worked otherwise. > What killed the shrink-wrapped market was first piracy I'm not convinced about that. Maybe video games had a problem, but money in software in general was in B2B, not B2C, and there the piracy was effectively mitigated by the legal system. In fact, both Microsoft and Adobe used piracy as opportunity because of that - kids would grow up using pirated copies of professional software, and then as adults, their companies and their employers would have to buy the properly licensed versions of that same software, because that's the only thing anyone has experience in using. > The SAAS model also has the benefit of aligning value delivery with outlays temporally. No more wait a year before shipping: instead get quick iteration with an ongoing revenue stream. You can recover from missteps in a way that the old model could not. SaaS has some benefits, but they tend to be single-sided, unless the customer and the vendor are comparable in power, which usually isn't the case. So while e.g. IBM or Microsoft can force Google or Adobe to behave, my small business will be taken advantage of by large SaaS vendors.
  - coliveira 3y ago
    And this is how it should be. Vendors need to be responsible for what they deliver, if it is FOSS or not.
    - gilcot 3y ago
      When you give a piece of cake, that doesn't make you a cake vendor, do you?
      - yawaramin 3y ago
        You misunderstood. In the scenario you replied to, you give a piece of cake, to someone who then sold it to someone else. They are the vendor, not you.
        gilcot 3y ago
        So we agree :)
        yawaramin 3y ago
        That was a piece of cake.
  - IshKebab 3y ago
    That could be a good thing - FOSS projects could sell liability protection to fund development.
    - delfinom 3y ago
      They won't, because they'll need to find an insurer willing to underwrite it. Good luck getting liability and omissions coverage without an established business entity or licensure. Insurers themselves want to know you are following the law rather than fly by night operations.
- deleted 3y ago
  [deleted]
sneed_chucker 3y ago
I mean, there's a reason most FOSS software licenses contain some variation of "THIS SOFTWARE IS PROVIDED 'AS IS' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES..."
- numbsafari 3y ago
  That's all software.
  - l33t7332273 3y ago
    I don’t think it is. If you pay for software it generally comes with some warranty and guarantee of fitness for purpose.
    - thesuperbigfrog 3y ago
      >> If you pay for software it generally comes with some warranty and guarantee of fitness for purpose. Generally it does not: Microsoft Windows EULA states: "Disclaimer. Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. Microsoft and the device manufacturer and installer exclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement. If your local law does not allow the exclusion of implied warranties, then any implied warranties, guarantees, or conditions last only during the term of the limited warranty and are limited as much as your local law allows. If your local law requires a longer limited warranty term, despite this agreement, then that longer term will apply, but you can recover only the remedies this agreement allows." Source: https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/U... Oracle EULA states: "Disclaimer of Warranties; Limitation of Liability THE PROGRAMS ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. ORACLE FURTHER DISCLAIMS ALL WARRANTIES, EXPRESS AND IMPLIED, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT." Source: https://www.oracle.com/downloads/licenses/standard-license.html https://www.oracle.com/downloads/licenses/standard-license.h...
numbsafari 3y ago
If the argument against laws is the existence of the lawless, why have laws at all?
- devwastaken 3y ago
  Those not self aware of rhetoric are doomed to repeat it.
coliveira 3y ago
FOSS has nothing to do with that. Companies providing products based on FOSS need to do their homework and check what they're using. If they can't guarantee that the FOSS library is reliable, they shouldn't use it.
Veserv 3y ago
No one size fits all regulatory quality requirement works. What needs to be done in commercial software, as is done in all other industries and in existing safety-critical software deployments, is segregating use cases by criticality and requiring deployments reach and guarantee the necessary quality level for that criticality class. It is the job and liability of the deployer to guarantee the requirements are met. They may push these requirements down to their suppliers, but it is the deployer that is ultimately responsible. This is why Home Depot is not required to only sell aircraft-grade rivets. It is the airplane manufacturer’s job to source adequate components, not the job of all component suppliers to guarantee their components are fit for all possible purposes. Under this model you can release any software you want. It is the manufacturer using the software that bears the burden of proving it is adequate. Or, if the software maker want to voluntarily take on extra burden, the software maker can verify and certify that the product is adequate for whatever purpose they wish to support. Quality where it is necessary, and flexibility where it is not.
deleted 3y ago
[deleted]

V__ 3y ago

I dont't think this would be a problem for FOSS. If I release an unsafe or not code compliant kitchen/house/etc. blueprint (and don't make claims to the contrary) nothing would happen to me. If I sell them the situation might be different. I think the same would apply to FOSS.

insanitybit 3y ago
Unless code somehow stops being speech, I see no way that this could impact FOSS (in the US).
ThrowawayR2 3y ago
All that that strategy would mean is that the costs of security auditing would fall onto the business using the FOSS code. It will start looking very attractive to instead buy code from an established software vendor who will provide some level of liability guarantees and assistance in auditing rather than going it alone with FOSS and in-house or external auditing.
- hiatus 3y ago
  The costs of security auditing already fall onto the businesses using FOSS code, though. A business just blindly incorporating code without static analysis, vulnerability checks, etc is not exercising due care.
- TeMPOraL 3y ago
  So basically, it would work like in every other industry? FOSS, for all the good it does, it also did break the economics of software. How much of the current problems with adtech, surveillance capitalism and VC funding stems from FOSS making it impossible to simply sell software components like products?
  - wbl 3y ago
    None of it. Emacs didn't kill word or Wang or WordPerfect. OS vendors still make money despite Linux and FreeBSD. The GIMP didn't kill Adobe. And if you want to sell proprietary libraries your market is going to be limited because OSs will distribute them and it will be hard to keep up when customers are fixing their own problems. What killed the shrink-wrapped market was first piracy and secondly the way people use their computers change. Then add on the easy sharing that e.g. Google docs enables and it's all over but the shouting. The SAAS model also has the benefit of aligning value delivery with outlays temporally. No more wait a year before shipping: instead get quick iteration with an ongoing revenue stream. You can recover from missteps in a way that the old model could not.
    - TeMPOraL 3y ago
      > Emacs didn't kill word or Wang or WordPerfect. Not sure how to respond to that. Emacs is around, the latter two I believe not, but approximately nobody is using them anyway. And I say that as someone who lives in Emacs. > OS vendors still make money despite Linux and FreeBSD. Apple makes money on hardware. Microsoft makes money on cloud, and has been desperately trying to turn Windows into a subscription service for a while now. They even non-humorously said exactly this in some message in (IIRC) installer or update screen - I remember Windows 10 telling me "Windows is a service" as if that was a good thing. > The GIMP didn't kill Adobe. No, but again, GIMP and Krita are used by approximately no one, meanwhile Adobe switched to a quite abusive subscription model. > And if you want to sell proprietary libraries your market is going to be limited because OSs will distribute them and it will be hard to keep up when customers are fixing their own problems. I don't see how. Think about the 100 (or 10 000, if you're doing webdev) dependencies your product uses. Most of those could be a licensed product, creating a cottage industry of small vendors making a living from developing specialized libraries. This thing is real in some areas, e.g. industrial software, where there are e.g. protocols that are too complex and boring for Open Source community to care about supporting in full. But it's something impossible in general, because popularity of open source simply prevents this kind of market from forming. Now, to be clear: I don't have a strong opinion on whether this is good or bad. Still trying to fully understand that one. But what I know for sure is that open source is a huge disruption to how the market would've worked otherwise. > What killed the shrink-wrapped market was first piracy I'm not convinced about that. Maybe video games had a problem, but money in software in general was in B2B, not B2C, and there the piracy was effectively mitigated by the legal system. In fact, both Microsoft and Adobe used piracy as opportunity because of that - kids would grow up using pirated copies of professional software, and then as adults, their companies and their employers would have to buy the properly licensed versions of that same software, because that's the only thing anyone has experience in using. > The SAAS model also has the benefit of aligning value delivery with outlays temporally. No more wait a year before shipping: instead get quick iteration with an ongoing revenue stream. You can recover from missteps in a way that the old model could not. SaaS has some benefits, but they tend to be single-sided, unless the customer and the vendor are comparable in power, which usually isn't the case. So while e.g. IBM or Microsoft can force Google or Adobe to behave, my small business will be taken advantage of by large SaaS vendors.
- coliveira 3y ago
  And this is how it should be. Vendors need to be responsible for what they deliver, if it is FOSS or not.
  - gilcot 3y ago
    When you give a piece of cake, that doesn't make you a cake vendor, do you?
    - yawaramin 3y ago
      You misunderstood. In the scenario you replied to, you give a piece of cake, to someone who then sold it to someone else. They are the vendor, not you.
      - gilcot 3y ago
        So we agree :)
        yawaramin 3y ago
        That was a piece of cake.
- IshKebab 3y ago
  That could be a good thing - FOSS projects could sell liability protection to fund development.
  - delfinom 3y ago
    They won't, because they'll need to find an insurer willing to underwrite it. Good luck getting liability and omissions coverage without an established business entity or licensure. Insurers themselves want to know you are following the law rather than fly by night operations.
deleted 3y ago
[deleted]

sneed_chucker 3y ago

I mean, there's a reason most FOSS software licenses contain some variation of "THIS SOFTWARE IS PROVIDED 'AS IS' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES..."

numbsafari 3y ago
That's all software.
- l33t7332273 3y ago
  I don’t think it is. If you pay for software it generally comes with some warranty and guarantee of fitness for purpose.
  - thesuperbigfrog 3y ago
    >> If you pay for software it generally comes with some warranty and guarantee of fitness for purpose. Generally it does not: Microsoft Windows EULA states: "Disclaimer. Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. Microsoft and the device manufacturer and installer exclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement. If your local law does not allow the exclusion of implied warranties, then any implied warranties, guarantees, or conditions last only during the term of the limited warranty and are limited as much as your local law allows. If your local law requires a longer limited warranty term, despite this agreement, then that longer term will apply, but you can recover only the remedies this agreement allows." Source: https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/U... Oracle EULA states: "Disclaimer of Warranties; Limitation of Liability THE PROGRAMS ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. ORACLE FURTHER DISCLAIMS ALL WARRANTIES, EXPRESS AND IMPLIED, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT." Source: https://www.oracle.com/downloads/licenses/standard-license.html https://www.oracle.com/downloads/licenses/standard-license.h...

numbsafari 3y ago

If the argument against laws is the existence of the lawless, why have laws at all?

devwastaken 3y ago
Those not self aware of rhetoric are doomed to repeat it.

coliveira 3y ago

FOSS has nothing to do with that. Companies providing products based on FOSS need to do their homework and check what they're using. If they can't guarantee that the FOSS library is reliable, they shouldn't use it.

Veserv 3y ago

No one size fits all regulatory quality requirement works. What needs to be done in commercial software, as is done in all other industries and in existing safety-critical software deployments, is segregating use cases by criticality and requiring deployments reach and guarantee the necessary quality level for that criticality class. It is the job and liability of the deployer to guarantee the requirements are met. They may push these requirements down to their suppliers, but it is the deployer that is ultimately responsible. This is why Home Depot is not required to only sell aircraft-grade rivets. It is the airplane manufacturer’s job to source adequate components, not the job of all component suppliers to guarantee their components are fit for all possible purposes. Under this model you can release any software you want. It is the manufacturer using the software that bears the burden of proving it is adequate. Or, if the software maker want to voluntarily take on extra burden, the software maker can verify and certify that the product is adequate for whatever purpose they wish to support. Quality where it is necessary, and flexibility where it is not.

deleted 3y ago

[deleted]